Key management (KMS).
Managed and customer-managed keys, HSM-backed, for encryption across every service.
Create, control and audit the encryption keys that protect your data — managed or customer-managed, HSM-backed, with policy over who and what can use each key.
- Category
- Identity & security
- Deployment
- Managed → air-gapped
- Governance
- IAM · encryption · audit
Three steps to running.
Platform-managed or bring your own, HSM-backed.
Fine-grained control over usage, rotation and grants.
Keys protect data across every service, every use audited.
Key management (KMS), in full.
Platform-managed keys, or bring and control your own.
Keys generated and held in validated hardware security modules.
Fine-grained control over usage, rotation and grants.
Every encrypt/decrypt logged for compliance.
Provision it in a few lines.
Every service is reachable from the same SDK, CLI and infrastructure-as-code — one identity, one bill, one audit trail across the whole catalog.
# Provision key management (kms) on Aether Cloud
aether identity-security create \
--service key-management \
--name app \
--region us-1 \
--deploy managed # or vpc | on-prem | air-gappedAt a glance.
- Keys
- Managed or BYOK
- Backing
- Validated HSM
- Policy
- Usage · rotation · grants
- Audit
- Every operation
- Scope
- Cross-service
Built for real work.
Envelope encryption
Regulatory key control
Customer-managed encryption
On one model, not stitched together.
The usual stack runs key management (kms) in one product, the model in another and the data in a third — and the seams between them are the cost. Aether Cloud runs it on the same platform that serves the model, governs your identity and deploys into your boundary, with the rest of the catalog one hop away.
No stitching a vector DB to one place, a warehouse to another and a model to a third — key management (kms) sits next to the rest of the catalog, one identity, one bill.
The provider that runs Aether runs your key management (kms) — so the data and the model never leave the same governed boundary to talk to each other.
Need a capability that isn’t here yet? The model writes and deploys it into the same boundary — the catalog is a starting point, not a ceiling.
Good to know.
Managed and customer-managed keys, HSM-backed — controlling encryption across the whole platform.
Yes — BYOK with full policy control over usage and rotation.
Yes — every encrypt/decrypt is logged.
Your boundary, your choice.
Pairs well with.
Fine-grained identity and access management with SSO, SCIM and short-lived credentials.
Centralized secrets with rotation, scoped access and full audit of every read.
Encryption in transit and at rest by default, with bring-your-own-key and envelope encryption.
Continuous posture management, findings and recommendations across your cloud footprint.
SOC 2 / ISO 27001 controls, evidence assembly and an immutable audit trail with provenance.
Policy-as-code guardrails and capability gating enforced across accounts and deployments.
Run Key management (KMS) on Aether Cloud.
Managed and customer-managed keys, HSM-backed, for encryption across every service. Deployable managed, in your VPC, on-prem or fully air-gapped — talk to us about the configuration your workloads and your boundary require.